Privacy Policy
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Marcel Ludwig Shephard
Dortmunder Str. 30
48155 Münster
Germany
Email: hello@zeitgeist-marketplace.de
2. Scope
This privacy policy applies to the Zeitgeist Marketplace mobile applications for Apple iOS and Google Android (the “App”) and to the website zeitgeist-marketplace.de (the “Website”). It explains the nature, scope and purpose of the processing of personal data.
Part A covers the App, Part B the Website and Part C the newsletter and emails. Part D applies to all of them.
This privacy policy does not apply to third-party websites and online stores that can be reached via the App or the Website, in particular the online stores of our partner shops. The respective operators are solely responsible for the processing of personal data on those websites.
Part A – App
3. Data we process in the App
Account data
- Email address
- Display name (optional)
- Encrypted authentication data
- Pseudonymised user ID
Usage and analytics data
In particular, we process:
- App launches
- Screen and page views
- Product views
- Search queries
- Clicks
- Favourites
- Shared content
- Voucher interactions
- Shop visits
- Referred orders
- Notification interactions
- Other interactions within the App
In addition, the following may be processed:
- Pseudonymised user ID
- Device token for push notifications
- Timestamp
- Event name
- App version
- Operating system
- Device information
- Language settings
- Error and crash information
4. Our own analytics platform
Zeitgeist Marketplace uses an in-house analytics system to analyse App usage, detect errors, improve usability, optimise our services and ensure secure and stable operation.
This data is not passed on to advertising networks or data brokers.
5. Google Analytics (Android only)
In the Android version, we use Google Analytics for Firebase to analyse usage and improve our services.
6. Pseudonymisation
Usage data collected is processed in pseudonymised form. This data does not directly identify you.
7. Purposes of processing
Data processing in the App serves in particular to:
- Provide the App
- Manage your user account
- Improve the App
- Analyse usage
- Analyse errors
- Detect security issues and misuse
- Optimise our services
- Send push notifications
8. Service providers
- Supabase (database and backend)
- Fly.io (hosting)
- Apple Push Notification service (APNs)
- Firebase Cloud Messaging (FCM)
- Google Analytics for Firebase (Android only)
- Brevo (email delivery, see section 19)
9. Push notifications
We use APNs on iOS and Firebase Cloud Messaging on Android to deliver push notifications.
10. Orders via partner shops
Zeitgeist Marketplace refers you to products from independent partner shops.
Orders, payments, invoices and shipping are handled exclusively by the respective partner shop. Zeitgeist Marketplace does not process credit card, PayPal or similar payment data.
Where necessary, information about referred orders may be processed in order to provide the platform, settle commissions and carry out statistical analysis.
11. Deleting your account
You can permanently delete your user account at any time directly within the App.
When you delete your account, all personal data associated with your user account is deleted or permanently anonymised.
Usage and analytics data already collected is separated from all personal or pseudonymous identifiers or permanently anonymised. After that, it is technically no longer possible to link it to you.
Fully anonymised statistical data may continue to be stored and analysed, as it no longer relates to any person and is used solely to improve, secure and develop our services.
Statutory retention obligations remain unaffected.
Part B – Website
12. Hosting and server log files
The Website runs on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you visit the Website, server log files are created automatically for technical reasons. These include, for example:
- IP address
- Date and time of the request
- Page or file requested
- Referrer URL
- Browser type and version
- Operating system
This data is used solely to ensure the technical operation and security of the Website and is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the Website.
13. Cookies and consent
On your first visit to the Website, we ask whether you consent to the use of Google Analytics. We store your choice in the cookie zg_consent (value “yes” for 12 months or “no” for 6 months) so that we do not have to ask you again on every visit. This cookie is strictly necessary (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).
Other cookies are only set if you have consented to Google Analytics (see section 14). We do not use advertising cookies.
You can change or withdraw your choice at any time with effect for the future:
14. Google Analytics (Website)
With your consent, we use Google Analytics 4 on the Website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies that make it possible to analyse how the Website is used, e.g. pages visited, time spent, approximate location, device type and clicks on the app store links.
The Google Analytics script is only loaded after you click “Accept”. Without your consent, no connection to Google Analytics is made and no analytics cookies are set. The cookies set by Google Analytics (_ga, _ga_*) are stored for up to 2 years. Google advertising features are disabled.
The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time using the button in section 13.
Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission. More information: policies.google.com/privacy.
15. Google Fonts
To display fonts consistently, the Website uses Google Fonts provided by Google Ireland Limited. When you open a page, your browser loads the fonts from Google’s servers. In the process, your IP address is transmitted to Google. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a consistent and appealing presentation of the Website.
16. Product images and content
Some images on the Website are loaded from our backend provider Supabase. For technical reasons, your IP address is transmitted to Supabase in the process. The legal basis is Art. 6(1)(f) GDPR.
17. Links to app stores and social networks
The Website contains links to the Apple App Store, Google Play, Instagram and TikTok. These are plain links, not embedded plugins. No data is transmitted to these providers until you click a link. From then on, the respective provider’s privacy policy applies.
Part C – Newsletter and emails
18. Newsletter
If you subscribe to our newsletter, we use your email address and, if provided, your first name to send you information about new shops, drops, sales, personalised recommendations and updates on your favourites and your shopping cart. The legal basis is your consent (Art. 6(1)(a) GDPR).
Subscription uses a double opt-in procedure: after signing up, you receive an email in which you confirm your subscription. If you sign up via a personal link in one of our emails, confirmation on the page that follows serves as proof. To document your consent, we store the time of sign-up and confirmation, the IP address, where you signed up (e.g. app or email) and the wording of the consent.
As a thank-you for subscribing, you receive a one-time €5 voucher after confirmation (minimum order value €30, redeemable once in each participating shop). The voucher is available only once per person, even if you subscribe again.
You can withdraw your consent at any time: via the unsubscribe link in every newsletter email, in the app under Settings → Newsletter, or by email to hello@zeitgeist-marketplace.de. After you unsubscribe, we remove your address from the newsletter mailing list. We keep the proof of consent for as long as we need it to defend against claims.
19. Email delivery via Brevo
We use Brevo (Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany) to send our emails. Brevo processes your email address and the data required for delivery on our behalf on servers in the EU; we have a data processing agreement with Brevo (Art. 28 GDPR). More information: brevo.com/en/legal/privacypolicy.
20. Service emails
Independently of the newsletter, we send you emails relating to your account, for example a welcome email after registration. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR) or our legitimate interest in informing our users (Art. 6(1)(f) GDPR).
21. Email analytics
To improve our emails, we analyse whether an email was opened and which links in it were clicked. For this purpose, links in our emails contain tags (so-called UTM parameters) that show which email and which button they come from. If you open the Zeitgeist app via such a link, we store this information with your account, which also allows us to see whether an order resulted from one of our emails.
The legal basis is your consent for newsletter emails (Art. 6(1)(a) GDPR) and our legitimate interest for service emails (Art. 6(1)(f) GDPR). You can object to this analysis at any time, e.g. by email to hello@zeitgeist-marketplace.de.
Part D – General information
22. Legal bases
Unless stated otherwise above, processing is based on Art. 6(1)(b) GDPR (contract or terms of use), Art. 6(1)(f) GDPR (legitimate interests) and, where required, Art. 6(1)(a) GDPR (consent).
23. Retention period
Personal data and pseudonymised usage data are stored only for as long as necessary to operate the platform, for security purposes, to comply with legal obligations or to develop our services further.
24. Your rights
You have the right at any time to:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
- Withdraw consent with effect for the future (Art. 7(3) GDPR)
To exercise your rights, simply send an email to hello@zeitgeist-marketplace.de.
You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).
25. Data security
We take appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access and manipulation. The Website is served exclusively over encrypted HTTPS connections.
26. International data transfers
Where service providers process data outside the European Economic Area, this is done only in compliance with statutory data protection requirements and with appropriate safeguards, e.g. an adequacy decision or EU Standard Contractual Clauses.
27. Changes to this privacy policy
We reserve the right to amend this privacy policy if legal changes or technical developments make this necessary.
The current version is always available in the App and at zeitgeist-marketplace.de/privacy.
Contact
Questions about privacy? hello@zeitgeist-marketplace.de
